On July 24, 2023, Palmswap's PLP vault was exploited for $901,000. The attacker used flashloans to purchase USDP at 1:1, inflated the pool value, then redeemed at the manipulated 1:1.9 rate by exploiting incorrect exchange rate calculations in PlpManager.

The Palmswap project on the BSC chain was attacked, and the attacker made a profit of more than 900,000 US dollars. According to the analysis of SlowMist, this attack was due to the fact that the authority control function of the core function was not enabled, and the price calculation model of the liquidity token was designed too simply, depending only on the number of USDT tokens in the treasury and the total supply, resulting in the attacker can use flash loans to maliciously manipulate prices to obtain unexpected profits. On July 28, Palmswap tweeted that 80% of the stolen funds had been returned, and the remaining 20% was used as a bug bounty for hackers.